[PATCH] bpf: make css iterator stay drained after NULL

[PATCH] bpf: make css iterator stay drained after NULL

[Kang Chen]

The css_next_*() helpers start from @start when given a NULL position.
bpf_iter_css_next() leaves kit->pos == NULL after the last element, but
keeps kit->start set, so a next() call after exhaustion starts the
iteration over from @start again.

The verifier relies on the iterator contract that once next() returns
NULL it keeps returning NULL: process_iter_next_call() marks the
iterator DRAINED and treats the result of later next() calls as the
constant zero.  A restarted css iteration therefore hands the BPF
program a kernel pointer while the verifier believes R0 == 0.

Clear kit->start when the position becomes NULL.  bpf_iter_css_destroy()
is a no-op, so no cleanup depends on @start after exhaustion.

Fixes: 7251d0905e75 ("bpf: Introduce css open-coded iterator kfuncs")
Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>
---
 kernel/bpf/cgroup_iter.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/kernel/bpf/cgroup_iter.c b/kernel/bpf/cgroup_iter.c
index fd51fe3d92cc..fb7ba1e45590 100644
--- a/kernel/bpf/cgroup_iter.c
+++ b/kernel/bpf/cgroup_iter.c
@@ -365,6 +365,16 @@ __bpf_kfunc struct cgroup_subsys_state *bpf_iter_css_next(struct bpf_iter_css *i
 		kit->pos = kit->pos ? kit->pos->parent : kit->start;
 	}
 
+	/*
+	 * A NULL position means either "not started yet" or "drained" for
+	 * css_next_*(), and all of them restart from @start when passed a
+	 * NULL position.  The verifier relies on an iterator which returned
+	 * NULL to keep returning NULL (see process_iter_next_call()), so
+	 * clear @start on exhaustion to make the next call return NULL.
+	 */
+	if (!kit->pos)
+		kit->start = NULL;
+
 	return kit->pos;
 }
 
-- 
2.34.1

Re: [PATCH] bpf: make css iterator stay drained after NULL

[Tejun Heo]

On Tue, Nov 10, 2026 at 08:51:10PM +0800, Kang Chen wrote:
> The css_next_*() helpers start from @start when given a NULL position.
> bpf_iter_css_next() leaves kit->pos == NULL after the last element, but
> keeps kit->start set, so a next() call after exhaustion starts the
> iteration over from @start again.
>
> The verifier relies on the iterator contract that once next() returns
> NULL it keeps returning NULL: process_iter_next_call() marks the
> iterator DRAINED and treats the result of later next() calls as the
> constant zero.  A restarted css iteration therefore hands the BPF
> program a kernel pointer while the verifier believes R0 == 0.
>
> Clear kit->start when the position becomes NULL.  bpf_iter_css_destroy()
> is a no-op, so no cleanup depends on @start after exhaustion.
>
> Fixes: 7251d0905e75 ("bpf: Introduce css open-coded iterator kfuncs")
> Signed-off-by: Kang Chen <k.chen@smail.nju.edu.cn>

Acked-by: Tejun Heo <tj@kernel.org>

BPF folks, how do you want to route this? It can go through the bpf
tree or I can take it through cgroup/for-7.4-fixes.

Thanks.

--
tejun